appsec-advisor

INTERNAL — invoked by appsec-threat-analyst in Phase 10c, one agent per abuse-case candidate (parallel fan-out like the Phase-9 STRIDE dispatch). Verifies a single abuse case end-to-end against the codebase: per chain step it locates the entry point, traces the sink, checks for compensating controls, and emits a step verdict ∈ {confirmed, blocked, inconclusive}. Writes one .abuse-case-verdict-<AC-ID>.json. Never rates risk — the chain verdict is computed deterministically from these step verdicts.

INTERNAL — invoked by appsec-threat-analyst at Phase 2.7 (after config-iac-scan, before architecture modeling). Performs LLM-based actor discovery: confirms relevance of static actor library entries and proposes additional repo-specific actors. Writes .actors-discovered.json. Skipped in quick-mode.

INTERNAL — invoked by the create-threat-model skill as Stage 4 when --architect-review is set. Performs an architect-level review of threat-model.md, threat-model.yaml, and the Management Summary. Writes narrative findings to $OUTPUT_DIR/.architect-review.md and a structured status signal to $OUTPUT_DIR/.architect-status.json; when technical defects are found (broken Mermaid, missing per-Critical walkthrough, §7.3 missing per-flow blocks, etc.) also writes $OUTPUT_DIR/.architect-repair-plan.json so the skill can re-render from fragments. Never edits the threat model directly.

INTERNAL — invoked by appsec-threat-analyst during Phase 2.5 (after recon, before STRIDE fan-out). Scans Dockerfile, GitHub Actions workflows, docker-compose, Dependabot/Renovate config, and npm/package config against data/config-iac-checks.yaml and emits one finding per violated check.

INTERNAL — invoked by appsec-threat-analyst. Resolves repository context from an optional REST endpoint, docs/business-context.md, and a prioritized set of common repository files (security policy, architecture docs, ADRs, OpenAPI specs, deployment configs, data model, env templates). Writes the combined context to docs/security/.threat-modeling-context.md for use by all other agents in the assessment pipeline.

Audit the current repository against a security requirements catalog and verify whether each requirement is implemented. Requirement IDs follow your catalog's own naming scheme (e.g. SEC-CSP-1, SCG-HARDENXML, or anything your YAML defines); tagging code with those IDs is optional and not required. Prints open requirements to the conversation with color-coded status and concise evidence. Optionally saves Markdown/PDF reports. With --json or --gate it also persists a deterministic structured verdict (.requirements-audit.json) and can act as a CI gate.

Preflight the Claude Code permission allow-list for the AppSec plugin. Reports which Bash/Write/Edit/Read rules from data/required-permissions.yaml are missing from the user's settings.json, so unattended /appsec-advisor:create-threat-model runs do not block on prompts. Read-only by default; --update merges missing entries into a chosen scope.

Remove stale run-state files left behind by a crashed or abruptly terminated threat-model assessment. Refuses to clean when an active run is still holding the lock. Use when the Claude Code UI shows the threat-modeling skill as "scanning" forever after a session crash.

Perform a threat assessment of a repository and produce a threat-model.md. Supports --repo to analyze external repos and --output to set the output directory. Optionally also writes threat-model.yaml with --yaml flag.

Maintainer/dev skill that triages an anonymised diagnostic bundle (appsec-diag-*.tgz, produced by scripts/diagnostic_bundle.py) a user sent after a pipeline failure. Runs the deterministic inspect, then cross-references the plugin source (scripts/, agents/phases/, AGENTS.md) and known-bug history to produce a grounded root-cause hypothesis. Does NOT re-run the pipeline and never needs the user's repo.

5 hooks across 5 events